Validating Validations - Who's Watching the Watcher?
summary
Lula is a CLI/TUI that repeatedly injects or collects Kubernetes resources, runs Rego/Kyverno checks, and emits OSCAL assessment-results showing whether webhook admission controllers accept, reject, or mutate inputs. Demo injects root-run pods and proves a cluster drift where previously-rejected pods become accepted, and validates custom-resource-generated network policies. Outputs are machine-readable OSCAL artifacts, can generate component definitions from control catalogs (NIST/CIS), and run as part of CI for continuous validation.
AI-written summary · about
chapters (8)
- 0:00Introduction and motivation
- 3:09Problems with admission controllers
- 8:33Lula framework overview
- 10:18Demo setup and first validation
- 13:07Behavioral validation with injection
- 16:05Demo results and insights
- 19:16Conclusion and future potential
- 20:24Q&A session
related talks
37mPath To Production: Sustainable Compliance In Strict Environments
41mAvoiding IAC Potholes with Policy + Cloud Controllers
40mCloud Native GRC
33mAm I Using It Right? Checking Best Practices on Live Kubernetes Clusters
38mOne Definition of Valid
30mSecuring LLMs in Kubernetes: Best Practices
24mKubernetes Operators: Safety First Through Model Checkers
16mWho Watches the Watchers? On the Reliability of Softwarizing Cloud Application Management